UELMA Exploring Authentication Options Nov 4, 2011 · UELMA Exploring Authentication Options Nov 4, 2011 . UELMA - Exploring Authorization Options Xcential Group, LLC 2 ... Adobe

A U T H E N T I C A T I O N M E T H O D S

P R E L I M I N A R Y R E P O R T

B R A D L E E C H A N G

X C E N T I A L G R O U P B R A D @ X C E N T I A L . C O M

UELMA Exploring Authentication Options

Nov 4, 2011

Xcential Group, LLC UELMA - Exploring Authorization Options

2

Overview

Many ways to authenticate primary legal documents

Solutions have varying capabilities

Costs range from nearly free to nearly $200,000.

We explored:

Basic Methods

Commercial Product Offerings

Six Typical Configurations

Advantages & Disadvantages

Costs


3

Agenda

I. Requirements

II. Authentication Methods

II. Components of Authentication Solutions

III. Sample Scenarios, Costs and Benefits

IV. Discussion


4

Requirements

Authenticity of Origin - verification that the

document is actually from the source that it claims to

come from (e.g. the State of California Office of

Legislative Counsel).

Document Integrity - verification that the

document has not been altered since it left its source.

What We Are Authenticating

Chaptered Bills (Statutes)

Chaptered Resolutions

Constitutional Amendments

State Constitution

State Codes

5


For Whom

General Public

Future Public

Libraries

Other Governmental Bodies

Private Sector Organizations

6


7

Agenda

I. Requirements




IV. Discussion


Authentication Building Blocks

UELMA - Exploring Authorization Options

8

CA fb4e … a67d CA CA

Xcential Group, LLC

Hash Codes


9

fb4e … a67d

Xcential Group, LLC


10

Hash Codes (a.k.a. Digests)

“Fingerprint” of a document If doc changes → hash changes

Impossible to recreate doc from hash

Infeasible to forge a doc matching a hash

Hashing Algorithms

SHA-1 Widely used, but no longer recommended1

SHA-2 Currently recommended1

SHA-3 Future development

MD5 Widely used, but proven to be weak

(1) http://csrc.nist.gov/groups/ST/hash/policy.html

Xcential Group, LLC


11

Creating a Hash Code

Many hash generation utilities

fb4e … a67d

Generate Hash Code

Xcential Group, LLC


12

Verifying a Hash Code

fb4e … a67d

Generate Hash Code

Retrieve Hash Code

fb4e … a67d

Secure Communications

Compare

Secure Server/ Website

Xcential Group, LLC

Hash Codes

Advantages Simple to implement

Ensures Document Integrity

Can be extended to ensure Authenticity of Origin

Supports any file type

Disadvantages Does not explicitly authenticate the origin

Can be vulnerable to man-in-the-middle and phishing attacks

Requires trusted retrieval of hash codes or a trusted verification service

Must have a method to match a document with its stored hash

Vulnerable to loss or corruption of true hash codes

Examples: Utah, Minnesota


13

Xcential Group, LLC


14

Digital Signatures

fb4e … a67d

Adds Encryption and Certificates to Hashing

Enables Authentication without external service or data

Xcential Group, LLC


15

Public Key Encryption

Mathematically created key pair

Private key

Public key

Encrypt data using private key

Only public key can decrypt

Encrypt data using public key

Only private key can decrypt

Xcential Group, LLC


16

Encrypting the Hash

Generate Hash Code

37ac … d2f6

Encrypt with Private Key

fb4e … a67d

37ac … d2f6

Xcential Group, LLC


17

Verifying an Encrypted Hash

Generate Hash Code

Decrypt with Public Key

fb4e … a67d

37ac … d2f6

Compare

fb4e … a67d

Xcential Group, LLC


18

Digital Certificates

International Standard Format (x.509)

Identity

Contact Information

Issuing Authority

Public Key

Self-Created

Issued by a “Certificate Authority”

Xcential Group, LLC


19

Creating a Signed Document

Generate Hash Code

37ac … d2f6

Encrypt with Private Key

fb4e … a67d

fb4e … a67d

Signed Document

Certificate

Xcential Group, LLC

Signed Document in Adobe Reader

Reader must be told to trust this Certificate


20

Xcential Group, LLC

Digital Signatures

Advantages

Verifiable Document Integrity

Verifiable Authenticity of Origin

Robust Industry Support (esp. Certificates, PDF)

Disadvantages

The signer must be trusted

Signer could be impersonated

Example: See Self-Signed PDF


21

Xcential Group, LLC


22

Public Key Infrastructure (PKI)

CA fb4e … a67d CA CA

Xcential Group, LLC


23

Public Key Infrastructure

Trusted Certification Authorities (CAs)

Verifies identity and issue Certificates:

Public Key

Verified info (identity)

Signed by CA, vouches for identity of public key owner

Trust CA → Trust Certificates issued by CA

E.g. web browsers have list of trusted CAs for secure web

connections (SSL)

E.g. Adobe Reader has list of CAs for PDF sigs

Xcential Group, LLC

Same as Signed Document

Only the Certificate is Different

PKI Signed Document


24

CA Office of

Leg. Counsel

VeriSign

Adobe

Xcential Group, LLC

PKI Signed Document in Adobe Reader


25

Xcential Group, LLC


26

PKI Certificates

Advantages

Same as Signed Document, plus:

Verifiable as long as any certificate in the chain is trusted

Can be verified even if the source is no longer available.

Automatic verification in Adobe Reader (CDS)

Disadvantages

More expensive to implement

Example: GPO

Xcential Group, LLC


27

Methods Summary

Hashing

Core feature of all authentication

Partial solution which can be made whole

Vulnerable to some risks

Digital Signature

Complete solution

Must trust the signer

Vulnerable to impersonation

Public Key Infrastructure

Establishes a Chain of Trust

High level of security

Xcential Group, LLC


28

Other Considerations

Archiving Formats (e.g. PDF/A)

Long Term Authentication

Controlling Document Usage

Printing, form filling, etc.

Key Management

Certificate renewal, revocation

Xcential Group, LLC


29

Long Term Validation

Sig validity at signing time is what matters

Certificates expire, can be revoked

Need to prove when signature was made

Crypto algorithms can weaken over time

EU Directive 1999/93/EC requirements

Technical solutions:

ETSI standards CAdES, XAdES, PAdES

Involve authenticated timestamping & embedding of

certificate chain in signatures

Xcential Group, LLC


30

Agenda

I. Requirements




IV. Discussion

Xcential Group, LLC


31

Components of a Solution

1. File Type Considerations

2. Certificates

3. Signing Software

4. Validation Software

Xcential Group, LLC


32

1. File Type Considerations

Some Files Support Embedded Signatures

PDF, some word processing formats

XMLDSig

External Signatures & Envelopes

Any file format can have detached signature

Validation highly inconvenient

Anything goes into a signed envelope

Slightly less inconvenient (can't lose sig)

PDF can be a signed envelope

Automated Validation

PDF Only

Xcential Group, LLC


33

2. Certificates – Who signed it?

Self-signed

Free!

Nobody trusts it! → Need trusted distribution (e.g. secure web site)

Well-known CA (PKI)

Not free

Various purposes, levels of assurance, prices

VeriSign, GeoTrust, Entrust, GlobalSign

CDS Certificate

Automatically trusted by Adobe Reader

Requires hardware support

Xcential Group, LLC


34

3. Signing Software

Desktop PDF

Standard Programming Libraries

iText

Adobe LiveCycle

Xcential Group, LLC


35

Desktop PDF Signing Apps

Adobe Acrobat, Aloaha PDF Signator

PDF only

Low cost, unless many copies needed

Any kind of certificate

Including hardware tokens

Fully manual signing

Open PDF, sign and save

Aloaha has batch mode, scripting capability

Xcential Group, LLC


36

Standard Programming Libraries

Java, MS-CAPI, .NET, etc.

Crypto algorithms, certificate handling

XML DSig implementations

Not applications => custom software needed to use

“Free” => cost is in developing app

Can be used to sign XML, HTML, anything

But not embedded PDF signatures

Can validate same

Xcential Group, LLC


37

iText

Programming library for PDF documents

Not an application => custom software needed to use

Free (open source) and paid versions

Any kind of certificate

Including hardware tokens (to be confirmed)

Suitable for automated mass signing

Xcential Group, LLC


38

Adobe LiveCycle ES 2

Large server-side application

“Digital Signatures” is one module

PDF only

Expensive

CDS certificates

Supports HSMs

Fully automated mass signing

Xcential Group, LLC


39

4. Validation Software

PDF Readers

Hash Comparators

Signature Validation Libraries

Online Services (Austria, MN)

Xcential Group, LLC


40

PDF Readers

Adobe Reader

Automatically validates signed PDFs

Trusts certificates tracing back to:

Adobe Root (Reader v6 & up)

Any root cert in AATL (Reader v9 and up)

(at user option) Any cert in Windows cert store

Free, highly convenient, proprietary

Foxit Reader

User activates signature validation

Seems to trust only certs in Windows store

Free, slightly less convenient, bug encountered

Xcential Group, LLC


41

Hash Comparators

Essentially the same as Hash Generators and Signing

Libraries.

Contained in many programming libraries

For integration in validation apps

Desktop apps (often free)

Web apps

Xcential Group, LLC

Signature Validation Libraries

Ready-made libraries to validate digital signatures

Built on top of standard libraries

Additional capabilities: server integration, file type detection, file type handling, certificate management, etc.

E.g. https://demo.a-sit.at/el_signatur/pruefung/index.html Open Source library used officially in Austria

Can be integrated in mass validation application

Can be integrated in online validation service


42

Xcential Group, LLC

https://demo.a-sit.at/el_signatur/pruefung/index.html




43

Online Services

Web site allowing file upload for signature/hash

verification

Hash verification requires access to trusted hash list

Must rely on file name, or search list for matching hash

Minnesota prototype

Signature verification more generic

Except for list of trusted root certificates

State of Austria implementation:

https://www.signature-verification.gv.at/

Xcential Group, LLC






44

Xcential Group, LLC


45

Agenda

I. Requirements




IV. Discussion

Xcential Group, LLC


46

Sample Configurations

Wide Range of Combinations possible

Picked 6 Typical Configurations

Manual to High Volume Automated

Xcential Group, LLC


47

Six Samples

1. Manual PDF

2. Mass Signing with iText

3. Highly Automated with Adobe LiveCycle

4. XML Signing with Java Libraries

5. PDF with Embedded XML and HTML

6. Signing and Secure Website

Xcential Group, LLC


48

Six Samples

Sample Security Volume Doc Types

Initial Cost

Annual Cost

Manual PDF

High Low PDF $1,049 $618

PDF with iText

High High PDF $22,100 $9,670

PDF with LiveCycle

High High PDF $170,100 $39,270

XML with Java Medium High

XML Dev. Only (Moderate)

TBD

PDF (XML, HTML) High

High

XML, HTML, PDF

$22,100 $9,670

Multi-Doc Type High

High Any Dev. Only (Higher)

TBD (Higher)

Xcential Group, LLC


49

1. Manual PDF signing

Entrust Group

CDS certificate

Adobe Acrobat X

with operator

Unsigned PDF Signed PDF

Xcential Group, LLC


50

1. Manual PDF signing

Initial Cost : $1,049 (Cert,Acrobat) + labor + PC

On-going Cost : $618/year for certificate renewal

Advantages

Low Initial Cost (for low volume)

CDS Certificate

Simple Process

Disadvantages:

Labor Intensive – impractical for high volume

Error Prone

Xcential Group, LLC


51

2. Mass Signing with IText

iText Libraries

+

Custom

Software

Entrust CDS

certificate


HSM

Xcential Group, LLC


52


Initial Cost:

$2,000 iText (1 server, free dev servers)

$7,000 Entrust Enterprise Lite Certificate

$13,100 SafeNet Luna SA HSM

$22,100 Total

Plus customization, system integration, server hardware

On-going Cost:

$400 iText Maintenance

$6,650 Entrust Enterprise Lite Certificate Renewal

$2,620 SafeNet Luna SA HSM Maintenance

$9,670/year Total

Xcential Group, LLC


53


Advantages

Automated

High Volume

PKI/CDS Certificate

Moderate Cost

Disadvantages

Custom software needs to be developed

Xcential Group, LLC


54


Entrust CDS

certificate


HSM

Xcential Group, LLC


55


Initial Cost

$150,000 LiveCycle DS (2 CPU + 1 Dev Server)



$170,100 Total


On-going Cost

$30,000 LiveCycle DS Maintenance



$39,270/year Total

Xcential Group, LLC


56


Advantages

High Volume

PKI/CDS Certificate

Integrated in a larger document management framework: Workflow, Forms, PDF generation from MS Office documents

Disadvantages

Expensive

Cost increases for multi-CPU setups

Xcential Group, LLC


57


A certificate

(self-signed)

Unsigned XML Signed XML

Java Libraries

+

Custom

Software

Xcential Group, LLC


58


Initial Cost :

Custom software

Optional certificate from a CA

On-going Cost

Optional certificate

Advantages

Inexpensive

Standardized Authentication (XMLDSig)

Disadvantages

Validation needs additional software

Xcential Group, LLC


59


Entrust CDS

certificate

Unsigned

Documents

Signed PDF

HSM

iText Libraries

+

Custom

Software

Xcential Group, LLC


60


Xcential Group, LLC


61


Initial Cost:

$2,000 iText (1 server, free dev servers)



$22,100 Total


On-going Cost:

$400 iText Maintenance



$9,670/year Total

Xcential Group, LLC


62


Advantages

Automated

High Volume

PKI/CDS Certificate

Validation of PDF, XML and HTML in one step

Moderate Cost

Disadvantages

Custom software needs to be developed

Human requires Adobe Reader or Acrobat to extract data

Automated processes need a PDF library to extract data

Xcential Group, LLC


63


Advantages

Automatic validation of PDF, XML and HTML in one step

Disadvantages

Human requires Adobe Reader or Acrobat to extract data

Automated processes need a PDF library to extract data

Xcential Group, LLC


64

6. Multi-Doc Signing and Validation

Signing Process

A certificate

(self-signed)

XML,

HTML,

PDF,

etc.

XmlDSig,

Signed PDF,

CMS/PKCS #7,

etc.

Java Libraries

+

Custom

Software

Xcential Group, LLC


65


Validation Process Document

Internet

Authentic

or

Altered

or

Bad Sig

Integration

Software

Validates

Secure Server

SSL

Open Source Code

Supported documents:

•XMLDSig,

•Signed PDF,

•CMS/PKCS #7,

•etc.

Xcential Group, LLC


66


Initial Cost

Development costs

Web server

On-going Cost

Little

Advantages

Numerous types of document may be verified

Disadvantages

Requires online access to verify document’s authenticity

Validation service must be maintained

Xcential Group, LLC


67

Agenda

I. Requirements




IV. Discussion

Xcential Group, LLC


68

Discussion

Questions?

Suggestions?

Additional Topics?

Next Steps?

Xcential Group, LLC


69

Discussion Ideas

Individual User Convenience

Batch Validation

Visual Fidelity

Source Content

Images

Archive File Formats - PDF, XML HTML, ?

Xcential Group, LLC